CVE-2026-115269High· 8.7▾ TwilightAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTIN…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.
Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.
This issue affects bandit: from 1.4.0 before 1.14.0.
bandit >= 1.4.0 < 1.14.0mtrudel/bandit >= fff06efe3be962b484bd4d3eb339372fda5a231f < 220b9dfd27f9a21305be2afc75cbe585ddc24e7aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Disable HTTP/2 with http_2_options: [enabled: false], so that the vulnerable read path never runs.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108525High· 8.7HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
CVE-2026-114213High· 8.7WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-110499High· 8.7Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
CVE-2026-111101High· 8.7HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-114216Medium· 6.3Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-110314Medium· 6.3WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit